Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.
For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.
Patches
The vulnerability is resolved in Next.js 13.5.1 and newer. This includes Next.js 14.x.
Workarounds
There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version.
A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.
Prerequisites
Next.js (<14.1.1) is running in a self-hosted* manner.
The Next.js application makes use of Server Actions.
The Server Action performs a redirect to a relative path which starts with a /.
* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.
Patches
This vulnerability was patched in #62561 and fixed in Next.js 14.1.1.
Workarounds
There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.
Credit
Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:
This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.
This PR contains the following updates:
13.4.1
->13.5.0
GitHub Vulnerability Alerts
CVE-2023-46298
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
CVE-2024-34350
Impact
Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.
For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.
Patches
The vulnerability is resolved in Next.js
13.5.1
and newer. This includes Next.js14.x
.Workarounds
There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version.
References
https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning
CVE-2024-34351
Impact
A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the
Host
header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.Prerequisites
<14.1.1
) is running in a self-hosted* manner./
.* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.
Patches
This vulnerability was patched in #62561 and fixed in Next.js
14.1.1
.Workarounds
There are no official workarounds for this vulnerability. We recommend upgrading to Next.js
14.1.1
.Credit
Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:
Adam Kues - Assetnote Shubham Shah - Assetnote
CVE-2024-39693
Impact
A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.
This vulnerability can affect all Next.js deployments on the affected versions.
Patches
This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.
Workarounds
There are no official workarounds for this vulnerability.
Credit
We'd like to thank Thai Vu of flyseccorp.com for responsible disclosure of this vulnerability.
Release Notes
vercel/next.js (next)
### [`v13.5.0`](https://redirect.github.com/vercel/next.js/compare/v13.4.19...v13.5.0) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.19...v13.5.0) ### [`v13.4.19`](https://redirect.github.com/vercel/next.js/releases/tag/v13.4.19) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.18...v13.4.19) ##### Core Changes - fix: invalid module transform for `@headlessui/react`: [#54206](https://redirect.github.com/vercel/next.js/issues/54206) - chore: remove unnecessary type cast in dev-build-watcher: [#54221](https://redirect.github.com/vercel/next.js/issues/54221) - fix process.env not being available in standalone mode: [#54203](https://redirect.github.com/vercel/next.js/issues/54203) - Fix missing `devPageFiles` collection: [#54224](https://redirect.github.com/vercel/next.js/issues/54224) - Add `Route` and `LinkProps` stub generics: [#54226](https://redirect.github.com/vercel/next.js/issues/54226) - Use `createClientModuleProxy` from Flight Server: [#54232](https://redirect.github.com/vercel/next.js/issues/54232) - Add default not found to loader tree of group routes root layer: [#54228](https://redirect.github.com/vercel/next.js/issues/54228) - feat(image): add support for custom `loaderFile` when `loader: default`: [#53417](https://redirect.github.com/vercel/next.js/issues/53417) - Fix renamed export of Server Actions: [#54241](https://redirect.github.com/vercel/next.js/issues/54241) - Ensures App Router Link respects scroll-behavior: smooth when only hash is changed.: [#54243](https://redirect.github.com/vercel/next.js/issues/54243) ##### Misc Changes - Update dd-trace used for internal tools: [#54214](https://redirect.github.com/vercel/next.js/issues/54214) - (Fix)Broken `upgrading.mdx` link : [#54234](https://redirect.github.com/vercel/next.js/issues/54234) - chore: skip CI run on forks: [#54219](https://redirect.github.com/vercel/next.js/issues/54219) - chore(ci): bump `cancel-workflow-action@0.11.0`: [#54246](https://redirect.github.com/vercel/next.js/issues/54246) ##### Credits Huge thanks to [@opnay](https://redirect.github.com/opnay), [@styfle](https://redirect.github.com/styfle), [@timneutkens](https://redirect.github.com/timneutkens), [@ztanner](https://redirect.github.com/ztanner), [@shuding](https://redirect.github.com/shuding), [@huozhi](https://redirect.github.com/huozhi), [@vinaykulk621](https://redirect.github.com/vinaykulk621), [@balazsorban44](https://redirect.github.com/balazsorban44), [@goguda](https://redirect.github.com/goguda), and [@coreyleelarson](https://redirect.github.com/coreyleelarson) for helping! ### [`v13.4.18`](https://redirect.github.com/vercel/next.js/releases/tag/v13.4.18) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.17...v13.4.18) ##### Core Changes - refactor: remove edge condition for module proxy path: [#54167](https://redirect.github.com/vercel/next.js/issues/54167) - Remove unused variables: [#54149](https://redirect.github.com/vercel/next.js/issues/54149) - chore: improve ts types for `position` in `dev-build-watcher`: [#54124](https://redirect.github.com/vercel/next.js/issues/54124) - Turbopack: Strip relative path prefix when generating PageLoaderAsset: [#54040](https://redirect.github.com/vercel/next.js/issues/54040) - Add `size` property to `ReadonlySearchParams`: [#53144](https://redirect.github.com/vercel/next.js/issues/53144) - Assign default not-found boundary if custom not-found is not present for root layer only: [#54185](https://redirect.github.com/vercel/next.js/issues/54185) - Allow range version for eslint config: [#53751](https://redirect.github.com/vercel/next.js/issues/53751) - Automatically modularizeImports for the popular [@headlessui/react](https://redirect.github.com/headlessui/react) library: [#54188](https://redirect.github.com/vercel/next.js/issues/54188) - fix bfcache restoration behavior: [#54198](https://redirect.github.com/vercel/next.js/issues/54198) ##### Misc Changes - Update rust toolchain: [#54130](https://redirect.github.com/vercel/next.js/issues/54130) ##### Credits Huge thanks to [@huozhi](https://redirect.github.com/huozhi), [@shuding](https://redirect.github.com/shuding), [@styfle](https://redirect.github.com/styfle), [@jridgewell](https://redirect.github.com/jridgewell), [@bencmbrook](https://redirect.github.com/bencmbrook), [@cramforce](https://redirect.github.com/cramforce), and [@ztanner](https://redirect.github.com/ztanner) for helping! ### [`v13.4.17`](https://redirect.github.com/vercel/next.js/releases/tag/v13.4.17) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.16...v13.4.17) ##### Core Changes - fix(next/image): empty blur image when animated [#54028](https://redirect.github.com/vercel/next.js/issues/54028) - Do not output pages 404 in tree view if app not-found is used: [#54051](https://redirect.github.com/vercel/next.js/issues/54051) - Fix scroll bailout logic when targeting fixed/sticky elements: [#53873](https://redirect.github.com/vercel/next.js/issues/53873) - Debug tracing: add updated modules and page to HMR span: [#53698](https://redirect.github.com/vercel/next.js/issues/53698) - fix(next-swc): coerce mdxrs default options: [#54068](https://redirect.github.com/vercel/next.js/issues/54068) - fix: don't add forceConsistentCasingInFileNames to tsconfig when ts version >= 5.0: [#51564](https://redirect.github.com/vercel/next.js/issues/51564) - fix(47299): allow testing pages with metadata in jsdom test environment: [#53578](https://redirect.github.com/vercel/next.js/issues/53578) - upgrade edge-runtime dependency: [#54117](https://redirect.github.com/vercel/next.js/issues/54117) - Fix root not-found page tree loader structure: [#54080](https://redirect.github.com/vercel/next.js/issues/54080) - chore: remove `as any` type cast: [#54074](https://redirect.github.com/vercel/next.js/issues/54074) - chore: refactor to use `fs.promises.rm()`: [#54076](https://redirect.github.com/vercel/next.js/issues/54076) - Refactor layout router creation in app-render: [#54126](https://redirect.github.com/vercel/next.js/issues/54126) - chore(image): remove apple silicon workaround for versions older than `node@16.5.0`: [#54125](https://redirect.github.com/vercel/next.js/issues/54125) - fix routing bug when bfcache is hit following an mpa navigation: [#54081](https://redirect.github.com/vercel/next.js/issues/54081) - Tracing: add opt-in flag to send a subset of development traces to url: [#53880](https://redirect.github.com/vercel/next.js/issues/53880) - fix(edge): override init when cloning with `NextRequest`: [#54108](https://redirect.github.com/vercel/next.js/issues/54108) - OpenTel: remove the internal (ipc) fetched from traces in a non-verbose mode: [#54083](https://redirect.github.com/vercel/next.js/issues/54083) - cleanup: remove unnecessary effect dep: [#54134](https://redirect.github.com/vercel/next.js/issues/54134) - Next build: use exported `handle_issues` from turbopack: [#52972](https://redirect.github.com/vercel/next.js/issues/52972) - node-web-streams: remove tee shim, use ReadableStream.tee: [#54079](https://redirect.github.com/vercel/next.js/issues/54079) - fix: `cookies().has()` breaks in app-route: [#54112](https://redirect.github.com/vercel/next.js/issues/54112) - Revert "fix(47299): allow testing pages with metadata in jsdom test environment": [#54160](https://redirect.github.com/vercel/next.js/issues/54160) ##### Documentation Changes - fix missing `'` in data-fetching/fetching-caching-and-revalidating: [#54058](https://redirect.github.com/vercel/next.js/issues/54058) ##### Example Changes - Update Docker example to remove HOSTNAME: [#54102](https://redirect.github.com/vercel/next.js/issues/54102) ##### Misc Changes - chore: hide "same on new version" without link: [#54048](https://redirect.github.com/vercel/next.js/issues/54048) - chore(ci): small notes for the build steps: [#54073](https://redirect.github.com/vercel/next.js/issues/54073) - chore: update lock bot wording: [#54099](https://redirect.github.com/vercel/next.js/issues/54099) - Update `swc_core` to `v0.79.59`: [#54082](https://redirect.github.com/vercel/next.js/issues/54082) - install-native.mjs: include `packageManager` field: [#54132](https://redirect.github.com/vercel/next.js/issues/54132) ##### Credits Huge thanks to [@balazsorban44](https://redirect.github.com/balazsorban44), [@huozhi](https://redirect.github.com/huozhi), [@ztanner](https://redirect.github.com/ztanner), [@williamli](https://redirect.github.com/williamli), [@wbinnssmith](https://redirect.github.com/wbinnssmith), [@kwonoj](https://redirect.github.com/kwonoj), [@stefanprobst](https://redirect.github.com/stefanprobst), [@feugy](https://redirect.github.com/feugy), [@timneutkens](https://redirect.github.com/timneutkens), [@kdy1](https://redirect.github.com/kdy1), [@Kikobeats](https://redirect.github.com/Kikobeats), [@styfle](https://redirect.github.com/styfle), [@dvoytenko](https://redirect.github.com/dvoytenko), [@MaxLeiter](https://redirect.github.com/MaxLeiter), and [@devjiwonchoi](https://redirect.github.com/devjiwonchoi) for helping! ### [`v13.4.16`](https://redirect.github.com/vercel/next.js/releases/tag/v13.4.16) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.15...v13.4.16) ##### Core Changes - Concept: test mode for Playwright and similar integration tools: [#52520](https://redirect.github.com/vercel/next.js/issues/52520) - Turbopack: fix hiding node_modules warnings in error overlay.: [#54022](https://redirect.github.com/vercel/next.js/issues/54022) - ci(next-swc): print glibc version when build: [#54026](https://redirect.github.com/vercel/next.js/issues/54026) - Adjust internal action proxy export: [#54004](https://redirect.github.com/vercel/next.js/issues/54004) ##### Documentation Changes - Update 05-client-side-rendering.mdx with latest tanstack query version: [#54009](https://redirect.github.com/vercel/next.js/issues/54009) - Open Graph Image font declaration moved to correct place: [#53998](https://redirect.github.com/vercel/next.js/issues/53998) - Update opengraph-image.mdx: Fix typo: [#54020](https://redirect.github.com/vercel/next.js/issues/54020) ##### Misc Changes - Remove extra label from runner: [#54002](https://redirect.github.com/vercel/next.js/issues/54002) - add standalone testcase for ipv6 hostnames: [#53999](https://redirect.github.com/vercel/next.js/issues/53999) - release: add release log generation script: [#54006](https://redirect.github.com/vercel/next.js/issues/54006) - test(ci): refine test suite name unique: [#54013](https://redirect.github.com/vercel/next.js/issues/54013) - Leverage previous swc build images: [#54027](https://redirect.github.com/vercel/next.js/issues/54027) - chore: mark build folder indexable: [#54029](https://redirect.github.com/vercel/next.js/issues/54029) - Move turbo outside of build for docker swc builds: [#54035](https://redirect.github.com/vercel/next.js/issues/54035) ##### Credits Huge thanks to [@ijjk](https://redirect.github.com/ijjk), [@ztanner](https://redirect.github.com/ztanner), [@huozhi](https://redirect.github.com/huozhi), [@lacymorrow](https://redirect.github.com/lacymorrow), [@dvoytenko](https://redirect.github.com/dvoytenko), [@kylemcd](https://redirect.github.com/kylemcd), [@kwonoj](https://redirect.github.com/kwonoj), [@tibi1220](https://redirect.github.com/tibi1220), [@wbinnssmith](https://redirect.github.com/wbinnssmith), and [@shuding](https://redirect.github.com/shuding) for helping! ### [`v13.4.15`](https://redirect.github.com/vercel/next.js/releases/tag/v13.4.15) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v13.4.13...v13.4.15) ##### Core Changes - Fix action failures due to state tree encoding: [#53655](https://redirect.github.com/vercel/next.js/issues/53655) - Initial HMR Nexturbo API implementation: [#52950](https://redirect.github.com/vercel/next.js/issues/52950) - Turbopack: add edge app routes : [#53387](https://redirect.github.com/vercel/next.js/issues/53387) - Turbopack: Hide Turbo Engine internals: [#53007](https://redirect.github.com/vercel/next.js/issues/53007) - add unit test case for next.rs api: [#53679](https://redirect.github.com/vercel/next.js/issues/53679) - Fix not-found rendering in production with edge: [#53687](https://redirect.github.com/vercel/next.js/issues/53687) - fix(next/image): don't call ReactDOM.preload if missing, such as jest: [#53443](https://redirect.github.com/vercel/next.js/issues/53443) - Add docs page for uncaught DynamicServerErrors: [#53402](https://redirect.github.com/vercel/next.js/issues/53402) - Consolidate Server and Routing process into one process: [#53523](https://redirect.github.com/vercel/next.js/issues/53523) - fix: Update outdated transform imports lucide-react: [#53697](https://redirect.github.com/vercel/next.js/issues/53697) - Update font data: [#53759](https://redirect.github.com/vercel/next.js/issues/53759) - Add warnings for static generation bail outs: [#53761](https://redirect.github.com/vercel/next.js/issues/53761) - Sort root entries per pageExtensions config for consistency: [#53769](https://redirect.github.com/vercel/next.js/issues/53769) - improve error message for conflicting parallel segments: [#53803](https://redirect.github.com/vercel/next.js/issues/53803) - Add `changeFrequency` and `priority` attributes to sitemaps: [#48484](https://redirect.github.com/vercel/next.js/issues/48484) - Ensure we set cache-control: no-cache for actions: [#53824](https://redirect.github.com/vercel/next.js/issues/53824) - Reuse RenderWorker type: [#53782](https://redirect.github.com/vercel/next.js/issues/53782) - fix: normalize backslash in `getStaticPaths()` for windows: [#53876](https://redirect.github.com/vercel/next.js/issues/53876) - Delete errorneous empty content length header: [#53843](https://redirect.github.com/vercel/next.js/issues/53843) - Turbopack: more tests and bugfixes for next.rs api: [#53809](https://redirect.github.com/vercel/next.js/issues/53809) - Add `@heroicons/react` to `modularizeImports`: [#53902](https://redirect.github.com/vercel/next.js/issues/53902) - Turbopack: Fix debugging in napi for next-api: [#53889](https://redirect.github.com/vercel/next.js/issues/53889) - Fix/match resource: [#53796](https://redirect.github.com/vercel/next.js/issues/53796) - Use summary_large_image as twitter card if images present by default: [#53919](https://redirect.github.com/vercel/next.js/issues/53919) - Turbopack: Emit whether server or client assets changed: [#53879](https://redirect.github.com/vercel/next.js/issues/53879) - Limit sharp's concurrency: [#53385](https://redirect.github.com/vercel/next.js/issues/53385) - enable [@vercel/og](https://redirect.github.com/vercel/og) support for turbopack: [#53917](https://redirect.github.com/vercel/next.js/issues/53917) - feat(image): DataURL placeholder support forConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.